Commit graph

8 commits

Author SHA1 Message Date
Dan Guido
b821080eba
Fix AWS Lightsail deployment error (boto3 parameter) (#14823)
* Fix AWS Lightsail deployment error by removing deprecated boto3 parameter

Remove the deprecated boto3 parameter from get_aws_connection_info() call
in the lightsail_region_facts module. This parameter has been non-functional
since amazon.aws collection 4.0.0 and was removed in recent versions bundled
with Ansible 11.x, causing deployment failures.

The function works correctly without this parameter as the module already
properly imports and validates boto3 availability.

Closes #14822

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Update uv.lock to fix Docker build failure

The lockfile was out of sync after the Ansible 11.8.0 to 11.9.0 upgrade.
This regenerates the lockfile to include:
- ansible 11.9.0 (was 11.8.0)
- ansible-core 2.18.8 (was 2.18.7)

This fixes the Docker build CI failure where uv sync --locked was failing
due to lockfile mismatch.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Fix Jinja spacing linter issues correctly

- Add spacing in lookup('env', 'VAR') calls
- Fix spacing around pipe operators within Jinja expressions only
- Preserve YAML block scalar syntax (prompt: |)
- Fix array indexing spacing within Jinja expressions
- All changes pass yamllint and ansible-lint tests

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add algo.egg-info to .gitignore

* Add unit test for AWS Lightsail boto3 parameter fix

- Tests that get_aws_connection_info() is called without boto3 parameter
- Verifies the module can be imported successfully
- Checks source code doesn't contain boto3=True
- Regression test specifically for issue #14822
- All 4 test cases pass

This ensures the fix remains in place and prevents regression.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Fix Python linting issues in test file

- Sort imports according to ruff standards
- Remove trailing whitespace from blank lines
- Remove unnecessary 'r' mode argument from open()
- Add trailing newline at end of file

All tests still pass after linting fixes.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
2025-08-16 03:39:00 -04:00
Dan Guido
0aaca43019
Security Hardening and Certificate Authority Constraints (#14811)
* Security hardening and certificate authority constraints

This commit addresses Issues #75 and #14804 with defensive security
enhancements that provide additional protection layers for edge case
scenarios.

## Issue #75: Technically Constrain Root CA
- Add pathlen:0 basic constraints preventing subordinate CA creation
- Implement name constraints restricting certificate issuance to specific IPs
- Add extended key usage restrictions limiting CA scope to VPN certificates
- Separate client/server certificate extensions (serverAuth vs clientAuth)
- Enhanced CA with critical constraints for defense-in-depth when CA keys saved

## Issue #14804: Comprehensive SystemD Security Hardening
- WireGuard: Added systemd hardening as additional defense-in-depth
- StrongSwan: Enhanced systemd configuration complementing AppArmor profiles
- dnscrypt-proxy: Additional systemd security alongside AppArmor protection
- Applied privilege restrictions, filesystem isolation, and system call filtering

## Technical Changes
- CA certificate constraints only relevant when users opt to save CA keys
- SystemD hardening provides additional isolation layers beyond existing AppArmor
- Enhanced client certificate validation for iOS/macOS profiles
- Reliable AppArmor profile enforcement for Ubuntu 22.04

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Address PR review feedback and improve code quality

## Fixes Based on Review Feedback:

### Handler Consistency Issues
- Fix notification naming: "daemon reload" → "daemon-reload" for consistency
- Update deprecated syntax: `daemon_reload: yes` → `daemon_reload: true`

### Enhanced CA Certificate Constraints
- Add .mil and .int to excluded DNS domains for completeness
- Add .mil and .int to excluded email domains for consistency
- Add explanatory comment for openssl_constraint_random_id security purpose

## Technical Improvements:
- Ensures proper handler invocation across DNS and WireGuard services
- Provides more comprehensive CA name constraints protection
- Documents the security rationale for UUID-based CA constraints

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Address PR review feedback - improve documentation and fix duplicate key

- Add IPv6 documentation range (2001:db8::/32) to excluded ranges
- Add explanatory comment for CA name constraints defense-in-depth purpose
- Remove duplicate DisableMOBIKE key from iOS configuration
- Add comprehensive comments to iOS/macOS mobileconfig parameters
- Explain MOBIKE, redirect disabling, certificate type, and routing settings

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
2025-08-04 20:22:41 -07:00
Jack Ivanov
0efa4eaf91 Ca certificate name constraints (#1675)
* X.509 Name Constraints

* nameConstraints to a random generated uuid

* Second level domain

* nameConstraints fixes

* critical in nameConstraints lost after last refactoring
2020-01-25 20:08:55 +07:00
Jack Ivanov
c6f45ead69
Allow OnDemand to be toggled later (#1557) 2019-09-06 09:33:36 +02:00
TC1977
d969b8e1b6 Fix 963 again (#1379)
* Create charon.conf.j2

Create charon.conf template with mods

* Update mobileconfig.j2

Increase client side lifetimes

* Update ipsec.conf.j2

Add server-side lifetimes

* Add charon.conf
2019-04-09 15:37:08 +03:00
Fabian Foerg
13c4628b5d Simplify Apple Profile Configuration Template (#1033)
* Simplify Apple Profile Configuration Template

* enable lstrip_blocks

* remove ldashes
2019-03-19 17:49:18 +01:00
Jack Ivanov
30beadb949
Modify naming in the cloud resources and client config files (#1353)
* Modify naming in the cloud resources and client config files

* Azure template: Eliminate unneeded variables
2019-03-15 18:16:26 +01:00
Jack Ivanov
273c7665d3 Refactoring (#1334)
<!--- Provide a general summary of your changes in the Title above -->

## Description
Renames the vpn role to strongswan, and split up the variables to support 2 separate VPNs. Closes #1330 and closes #1162
Configures Ansible to use python3 on the server side. Closes #1024 
Removes unneeded playbooks, reorganises a lot of variables
Reorganises the `config` folder. Closes #1330
<details><summary>Here is how the config directory looks like now</summary>
<p>

```
configs/X.X.X.X/
|-- ipsec
|   |-- apple
|   |   |-- desktop.mobileconfig
|   |   |-- laptop.mobileconfig
|   |   `-- phone.mobileconfig
|   |-- manual
|   |   |-- cacert.pem
|   |   |-- desktop.p12
|   |   |-- desktop.ssh.pem
|   |   |-- ipsec_desktop.conf
|   |   |-- ipsec_desktop.secrets
|   |   |-- ipsec_laptop.conf
|   |   |-- ipsec_laptop.secrets
|   |   |-- ipsec_phone.conf
|   |   |-- ipsec_phone.secrets
|   |   |-- laptop.p12
|   |   |-- laptop.ssh.pem
|   |   |-- phone.p12
|   |   `-- phone.ssh.pem
|   `-- windows
|       |-- desktop.ps1
|       |-- laptop.ps1
|       `-- phone.ps1
|-- ssh-tunnel
|   |-- desktop.pem
|   |-- desktop.pub
|   |-- laptop.pem
|   |-- laptop.pub
|   |-- phone.pem
|   |-- phone.pub
|   `-- ssh_config
`-- wireguard
    |-- desktop.conf
    |-- desktop.png
    |-- laptop.conf
    |-- laptop.png
    |-- phone.conf
    `-- phone.png
```

![finder](https://i.imgur.com/FtOmKO0.png)

</p>
</details>

## Motivation and Context
This refactoring is focused to aim to the 1.0 release

## How Has This Been Tested?
Deployed to several cloud providers with various options enabled and disabled

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Refactoring

## Checklist:
<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
- [x] I have read the **CONTRIBUTING** document.
- [x] My code follows the code style of this project.
- [x] My change requires a change to the documentation.
- [x] I have updated the documentation accordingly.
- [x] All new and existing tests passed.
2019-03-10 13:16:34 -04:00
Renamed from roles/vpn/templates/mobileconfig.j2 (Browse further)